在ASP.NET中实现OAuth2.0之打造自己的API安全策略

Posted 荒古禁地

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了在ASP.NET中实现OAuth2.0之打造自己的API安全策略相关的知识,希望对你有一定的参考价值。

1、场景介绍

  公司开发了一款APP产品,前期提供的api接口都是裸奔状态

  举个例子:想要获取某一个用户的数据,只需要传递该用户的ID就可以拿走数据(说多了都是泪)

  现在想给这些接口穿个衣服,加个壳(对客户端进行授权)

2、业务实现

  > 搭建授权服务器和资源服务器

  > 给App客户端发放AppId和AppSecret

  > 用户向App客户端提供自己的账号和密码

  > App客户端将AppId、AppSecret、账号和密码提交到授权服务器

  > 授权服务器通过授权,发放token和refresh_token

  > 客户端通过token与资源服务器进行对接,并对token进行管理,防止失效

3、代码实现

  1)用vs2015/vs2013新建mvc或者api项目,vs会生成一堆oauth代码(备注:vs2012的项目,需要引用相关dll并手动补充相关代码)

  2)打开Startup.Auth.cs,将不用代码注释,打开Startup.cs对oauth进行配置

using Microsoft.Owin;
using Microsoft.Owin.Security.OAuth;
using Owin;
using System;

[assembly: OwinStartupAttribute(typeof(OSA.Server.Startup))]
namespace OSA.Server
{
    public partial class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);

            var OAuthOptions = new OAuthAuthorizationServerOptions
            {
                TokenEndpointPath = new PathString("/token"),
                Provider = new Code.AuthorizationServerProvider(),
                RefreshTokenProvider = new Code.RefreshTokenProvider(),
                //AccessTokenFormat = new Code.SecureDataFormat(),//自定义access_token信息序列化加密格式
                AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(10),
                AllowInsecureHttp = true,
            };

            app.UseOAuthBearerTokens(OAuthOptions);
        }
    }
}

  3)重写OAuthAuthorizationServerProvider,搭建授权服务器,定义自己的授权方式

using Microsoft.Owin.Security;
using Microsoft.Owin.Security.OAuth;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using System.Web;

namespace OSA.Server.Code
{
    public class AuthorizationServerProvider : OAuthAuthorizationServerProvider
    {
        /// <summary>
        /// 第三方应用身份验证
        /// </summary>
        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            string clientId;
            string clientSecret;

            //1.身份验证凭证在请求头,使用context.TryGetBasicCredentials(clientId, clientSecret)获取信息
            context.TryGetBasicCredentials(out clientId, out clientSecret);

            //2.身份验证凭证在Post参数中,使用context.TryGetFormCredentials(clientId, clientSecret)获取信息
            //context.TryGetFormCredentials(out clientId, out clientSecret);

            //读取数据仓储,判断是否为合法的第三方应用
            var client = new Data.Client().GetDetail(clientId);

            if (client == null || client.Secret != clientSecret)
            {
                context.SetError("非法的身份凭证信息!");
            }
            else
            {
                //refresh_token持久化的时候使用
                context.OwinContext.Set<string>("as:client_id", clientId);
                context.OwinContext.Set<string>("as:clientRefreshTokenLifeTime", client.RefreshTokenLifeTime.ToString());

                //TODO:有疑问……
                context.Validated(clientId);
            }

            return base.ValidateClientAuthentication(context);
        }

        /// <summary>
        /// 授予第三方应用凭证
        /// </summary>
        public override Task GrantClientCredentials(OAuthGrantClientCredentialsContext context)
        {
            var oAuthIdentity = new ClaimsIdentity(context.Options.AuthenticationType);

            oAuthIdentity.AddClaim(new Claim(ClaimTypes.Name, "ClientCredentials"));

            //var ticket = new AuthenticationTicket(oAuthIdentity, new AuthenticationProperties());

            //为了验证client_id,需要在 GrantClientCredentials() 重载方法中保存client_id至context.Ticket
            var ticket = new AuthenticationTicket(oAuthIdentity, new AuthenticationProperties(new Dictionary<string, string>
                {
                    { "as:client_id", context.ClientId }
                }));

            context.Validated(ticket);

            return base.GrantClientCredentials(context);
        }
/// <summary> /// 授予资源所有者凭证 /// </summary> public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context) { //读取数据仓储,判断是否为用户账号和密码是否有效 var entity = new Data.Member().GetDetail(context.UserName, context.Password); if (entity == null) { context.SetError("非法的身份凭证信息!"); } else { var oAuthIdentity = new ClaimsIdentity(context.Options.AuthenticationType); oAuthIdentity.AddClaim(new Claim(ClaimTypes.Name, entity.Id)); oAuthIdentity.AddClaim(new Claim(ClaimTypes.UserData, entity.ToJsonByJsonNet())); //为了验证client_id,需要在 GrantClientCredentials() 重载方法中保存client_id至context.Ticket var ticket = new AuthenticationTicket(oAuthIdentity, new AuthenticationProperties(new Dictionary<string, string> { { "as:client_id", context.ClientId } })); context.Validated(ticket); await base.GrantResourceOwnerCredentials(context); } } /// <summary> /// 授予RefreshToken凭证 /// </summary> public override async Task GrantRefreshToken(OAuthGrantRefreshTokenContext context) { //验证client_id //var originalClient = context.Ticket.Properties.Dictionary["as:client_id"]; //var currentClient = context.ClientId; //if (originalClient != currentClient) //{ // context.Rejected(); // return; //} var newId = new ClaimsIdentity(context.Ticket.Identity); newId.AddClaim(new Claim("newClaim", "refreshToken")); var newTicket = new AuthenticationTicket(newId, context.Ticket.Properties); context.Validated(newTicket); await base.GrantRefreshToken(context); } } }

  4)重写AuthenticationTokenProvider,搭建授权服务器,定义自己的授权方式

using Microsoft.Owin.Security.Infrastructure;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Linq;
using System.Web;

namespace OSA.Server.Code
{
    /// <summary>
    /// refresh_token会被第三方应用使用,用来维持access_token的持续可用,
    /// 因此需要将refresh_token持久化,避免服务重启后,refresh_token失效问题
    /// </summary>
    public class RefreshTokenProvider : AuthenticationTokenProvider
    {
        public override void Create(AuthenticationTokenCreateContext context)
        {
            var clietId = context.OwinContext.Get<string>("as:client_id");
            if (string.IsNullOrEmpty(clietId)) return;

            var refreshTokenLifeTime = context.OwinContext.Get<string>("as:clientRefreshTokenLifeTime");
            if (string.IsNullOrEmpty(refreshTokenLifeTime)) return;

            string tokenValue = Guid.NewGuid().ToString("n");

            var refreshToken = new Data.RefreshToken()
            {
                Id = tokenValue,
                ClientId = clietId,
                UserName = context.Ticket.Identity.Name,
                IssuedUtc = DateTime.UtcNow,
                ExpiresUtc = DateTime.UtcNow.AddDays(Convert.ToDouble(refreshTokenLifeTime)),
                ProtectedTicket = context.SerializeTicket()
            };

            context.Ticket.Properties.IssuedUtc = DateTime.UtcNow;
            context.Ticket.Properties.ExpiresUtc = refreshToken.ExpiresUtc;

            if (!refreshToken.Save()) return;

            context.SetToken(tokenValue);
        }

        public override void Receive(AuthenticationTokenReceiveContext context)
        {
            var refreshToken = new Data.RefreshToken().GetDetail(context.Token);

            if (refreshToken != null)
            {
                context.DeserializeTicket(refreshToken.ProtectedTicket);
            }
        }
    }
}

  5)对用户、客户端、Refreshtoken进行持久化

    /// <summary>
    /// 持久化第三方应用类
    /// </summary>
    public class Client
    {
        /// <summary>
        /// 应用Id
        /// </summary>
        public string Id { get; set; }

        /// <summary>
        /// 应用秘钥
        /// </summary>
        public string Secret { get; set; }

        /// <summary>
        /// 应用名称
        /// </summary>
        public string Name { get; set; }

        /// <summary>
        /// 是否激活
        /// </summary>
        public bool IsActive { get; set; }

        /// <summary>
        /// refresh_token使用期
        /// </summary>
        public int RefreshTokenLifeTime { get; set; }

        public Client GetDetail(string id)
        {
            if (id != "yk1ec4b1ff655c5709")
                return null;

            return new Client()
            {
                Id = id,
                Secret = "4fd823ea538dcdc90afeeeac3bfc5b70",
                Name = "App应用",
                IsActive = true,
                RefreshTokenLifeTime = 30,
            };
        }
    }
    /// <summary>
    /// 持久化用户信息
    /// </summary>
    public class Member
    {
        public string Id { get; set; }

        public string Account { get; set; }

        public string Nickname { get; set; }

        public string Role { get; set; }

        public Member GetDetail(string id)
        {
            if (id == "1f04166e7b7441e6876916abf00c4f05")
            {
                return new Member()
                {
                    Id = "1f04166e7b7441e6876916abf00c4f05",
                    Account = "手机号",
                    Nickname = "荒古禁地",
                    Role = "administrator"
                };
            }

            return null;
        }

        public Member GetDetail(string account, string password)
        {
            if (account == "手机号" && password == "123456")
            {
                return new Member()
                {
                    Id = "1f04166e7b7441e6876916abf00c4f05",
                    Account = "手机号",
                    Nickname = "荒古禁地",
                    Role = "administrator"
                };
            }

            return null;
        }
    }
    /// <summary>
    /// 持久化RefreshToken类
    /// </summary>
    public class RefreshToken
    {
        /// <summary>
        /// refresh_token值
        /// </summary>
        public string Id { get; set; }

        /// <summary>
        /// 用户账号
        /// </summary>
        public string UserName { get; set; }

        /// <summary>
        /// 第三方应用Id
        /// </summary>
        public string ClientId { get; set; }

        /// <summary>
        /// 发布时间
        /// </summary>
        public DateTime IssuedUtc { get; set; }

        /// <summary>
        /// 有效时间
        /// </summary>
        public DateTime ExpiresUtc { get; set; }

        /// <summary>
        /// access_token信息
        /// </summary>
        public string ProtectedTicket { get; set; }

        public RefreshToken GetDetail(string id)
        {
            return list.FirstOrDefault(x => x.Id == id);
        }

        private static List<RefreshToken> list = new List<RefreshToken>();

        public bool Save()
        {
            list.Add(this);
            return true;
        }
    }

  6)封装资源接口,获取token

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Threading.Tasks;
using System.Web.Http;

namespace OSA.Server.Controllers
{
    public class TokenController : ApiController
    {
        protected HttpClient _httpClient;

        /// <summary>
        /// 构造函数
        /// </summary>
        public TokenController()
        {
            _httpClient = new HttpClient();
            _httpClient.BaseAddress = new Uri("http://localhost:5000/");
        }

        /// <summary>
        /// 发放访问令牌
        /// </summary>
        /// <param name="grant_type">访问类型</param>
        /// <param name="appid">应用Id</param>
        /// <param name="secret">应用秘钥</param>
        /// <returns>访问令牌</returns>
        public async Task<object> GetClientCredentialsToken(string grant_type, string appid, string secret)
        {
            if (grant_type == "client_credentials")
                return await CreateClientCredentialsAccessToken(appid, secret);

            return "不支持的授权类型";
        }

        /// <summary>
        /// 发放访问令牌
        /// </summary>
        /// <param name="grant_type">访问类型</param>
        /// <param name="appid">应用Id</param>
        /// <param name="secret">应用秘钥</param>
        /// <param name="username">用户账号</param>
        /// <param name="password">用户密码</param>
        /// <returns>访问令牌</returns>
        public async Task<object> GetPasswordToken(string grant_type, string appid, string secret, string username, string password)
        {
            if (grant_type == "password")
                return await CreatePasswordAccessToken(appid, secret, username, password);

            return "不支持的授权类型";
        }

        /// <summary>
        /// 发放访问令牌
        /// </summary>
        /// <param name="appid">应用Id</param>
        /// <param name="secret">应用秘钥</param>
        /// <param name="refresh_token">刷新令牌</param>
        /// <returns>访问令牌</returns>
        public async Task<object> GetRefreshToken(string appid, string secret, string refresh_token)
        {
            return await GetAccessTokenByRefreshToken(appid, secret, refresh_token);
        }

        /// <summary>
        /// 发放访问令牌(client_credentials模式)
        /// </summary>
        private async Task<object> CreateClientCredentialsAccessToken(string appid, string secret)
        {
            //将身份验证凭证信息放入请求头中
            _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes(appid + ":" + secret)));

            //拼装Post参数信息
            var parameters = new Dictionary<string, string>();
            parameters.Add("grant_type", "client_credentials");

            //请求输出访问令牌
            var responseResult = _httpClient.PostAsync("/token", new FormUrlEncodedContent(parameters)).Result;
            var responseValue = await responseResult.Content.ReadAsStringAsync();

            return responseValue;
        }

        /// <summary>
        /// 发放访问令牌(password模式)
        /// </summary>
        private async Task<object> CreatePasswordAccessToken(string appid, string secret, string username, string password)
        {
            //将身份验证凭证信息放入请求头中
            _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes(appid + ":" + secret)));

            //拼装Post参数信息
            var parameters = new Dictionary<string, string>();
            parameters.Add("grant_type", "password");
            parameters.Add("username", username);
            parameters.Add("password", password);

            //请求输出访问令牌
            var responseResult = _httpClient.PostAsync("/token", new FormUrlEncodedContent(parameters)).Result;
            var responseValue = await responseResult.Content.ReadAsStringAsync();

            return responseValue;
        }

        /// <summary>
        /// 发放访问令牌(refresh_token模式)
        /// </summary>
        private async Task<object> GetAccessTokenByRefreshToken(string appid, string secret, string refresh_token)
        {
            //将身份验证凭证信息放入请求头中
            _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes(appid + ":" + secret)));

            //拼装Post参数信息
            var parameters = new Dictionary<string, string>();
            parameters.Add("grant_type", "refresh_token");
            parameters.Add("refresh_token", refresh_token);

            //请求输出访问令牌
            var response = await _httpClient.PostAsync("/token", new FormUrlEncodedContent(parameters));
            var responseValue = await response.Content.ReadAsStringAsync();

            return responseValue;
        }
    }
}
View Code

  7)封装资源接口,获取登录用户信息

namespace OSA.Server.Controllers
{
    [Authorize]
    public class BasicController : ApiController
    {
        public string AuthorizationId
        {
            get
            {
                return User.Identity.Name;

                //var claimsIdentity = User.Identity as System.Security.Claims.ClaimsIdentity;

                //var claim = claimsIdentity.FindFirst(System.Security.Claims.ClaimTypes.UserData);

                //return claim.Value.ToObjectByJsonNet<Data.Member>().Id;
            }
        }
    }
}

namespace OSA.Server.Controllers
{
    public class AccountController : BasicController
    {
        public object Get(string id)
        {
            return new Data.Member().GetDetail(AuthorizationId);
        }
    }
}
View Code

  8)为了让做app的同学,方便调用接口,对接口进行二次封装